Quote from: vbscarred on January 19, 2012, 09:18:49 AM

Quote from: znort987 on January 19, 2012, 08:49:41 AM

SSH attacks are a common fact of life for anyone operating a server.
fail2ban is a fairly decent tool to handle them.
http://www.fail2ban.org

I agree. Another, and even more effective way to protect against SSH brute force attacks is to change the port the SSH server is running on.

I used to get over 1000 brute force attempts per day during the beginning of 2011. After installing fail2ban it went down to 30-40 attempts per day. Then I changed the SSH port to a port in the mid 1000's, which did the trick fully. The last three months, I've had one (1) failed login attempt, and I'm pretty sure that was me, mistyping the password.

Also, I created this Bash alias to track failed SSH login attempts:

Code:

alias failedlogin='sudo cat /var/log/auth.log* | grep '\''Failed password'\'' | grep sshd | awk '\''{print $1,$2}'\'' | sort -k 1,1M -k 2n | uniq -c'

As a final tip, the most secure way to login to an SSH server is to login with a private key, which will save you from keyloggers. Storing this on a USB drive will increase this security.

Two good tips, thank you for bringing them here.